Science and technology

Malware

The number is no longer in service

ON JULY 9th users of hundreds of thousands of computers worldwide will be mystified. They will no longer be able to access websites, e-mail servers and other resources despite an active internet connection. The indirect culprit is the DNS Changer Trojan horse, a piece of malware which tweaks operating-system settings on computers and residential internet routers so as to redirect traffic to certain sites and rack up advertising fees. But it is America's Federal Bureau of Investigations (FBI) that is the proximate cause of the disruption.

Last November the FBI led an international raid to shut down the malware operation. Seven men have been charged, six captured, and so far one extradited from Estonia last month. The trouble is that the gumshoes could not simply turn off the malicious domain name system (DNS) servers, which translate intelligible website addresses like economist.com into numerical ones like 64.14.173.202. This would have meant that any computer which the malware routed through the subverted DNS server would find its connection severed.

The scammers made their money, a suspected $14m, by redirecting links from Netflix, Apple's iTunes and the Internal Revenue Service (IRS), among others, to another service which paid a fee for each arriving user. Some of the destinations were none the wiser, like H&R Block, a tax consultancy, receiving IRS traffic. Others may have been fully aware. They complemented this "click hijacking" with "advertising replacement fraud", where ads on legitimate sites were replaced with other, pay-per-pageview ones that also paid for resulting sales. For most requests, however, the fraudsters' DNS servers returned legitimate results.

When the subverted DNS servers are shut down, the user's browser no longer knows where to send page requests and other internet software will be baffled as well, at least until a user employs "rootkit removal software", reinstalls Windows or reconfigures the router. This is beyond the ken of most users. So, in order to avoid disruption, the FBI secured a judge's permission to have a trusted third-party take over the DNS service until March 8th. Paul Vixie, the father of DNS and founder of the Internet Systems Consortium (ISC), a non-profit that manages open-source internet infrastructure software, tells a thrilling tale of midnight server-room activity after the international raid had taken place. At that time as many as 4.5m devices routinely consulted the rogue servers.

March 8th proved too optimistic, however. As many as 500,000 machines in America and five times as many elsewhere remained affected by the end of February. The FBI managed to wangle an extension until July 9th. On that day, though, the plug will be pulled. An international industry consortium, the DNS Changer Working Group, has strived to inform as many users as possible.

These efforts were stepped up on May 2nd. CloudFlare, a content-distribution network, added a feature for its clients on behalf of whom CloudFlare feeds out web pages and media files to 350m unique visitors a month. Flip a switch and Cloudfare-served pages sniff for infected users, alert them to the problem and provide advice on removing the malware. CloudFlare also released a bit of JavaScript code that any website can use to the same end. And on May 22nd Google joined the fray, alerting users of its search page who are infected. Google estimates it will reach 500,000 users within a week.

Major internet service providers also have contingency plans to intercept requests for the shuttered DNS servers and re-route them internally to their own, kosher ones. This is a Band-Aid, not surgery—but it will do the trick for now.

The big problem is that warnings presented to users by Cloudflare, Google and others may themselves seem like scams to those who continue to be affected, especially since a disproportionate number of them are likely to be unsophisticated users—those better informed would have flushed the malware out by now. As a result, the worm may remain on many computers indefinitely. Mr Vixie notes that years after the emergence of the Conficker worm, the worst malware in history by number of devices infected, it continues to wreak havoc with millions of machines. Computer worms, it seems, are changing from an acute condition that can be cured with a swift intervention into a chronic disease.

Yes: if the cell phone connects via Wi-Fi to an affected router. No: over 2G, 3G, 4G, and unaffected routers on Wi-Fi networks.
Also, on a Wi-Fi network on which the router is fine, but there is an infected computer, this DNS Changer variant attempts to poison DHCP assignment. Thus, a cell phone using Wi-Fi on a network with an infected machine could have its values temporarily replaced if the DHCP assignment is hijacked.

I really doubt this! I remember reading something similar sometime back. But, it never happened. I would call this a mere scare! And we all know, there is nothing a bunch of hackers or spammers can do to the Web and Internet on a massive scale. Some users may temporarily get disconnected, but the larger service will still continue.

That said, when we have the Internet being used on virtually every domain today, any stupid prank like this can result in worldwide chaos and the world would soon need to put things back in order!

The hackers don't even need to compromise your computer. Last year I noticed something like this happening and tracked the problem down to my DSL modem, which had been shipped (by TalkTalk) with WAN administration enabled by default. The DNS server address(es) had been modified to 95.168.162.12 and 95.168.162.22.

A quick port-scan of IP addresses that are near to mine revealed that I wasn't the only TalkTalk customer affected. The tech support people I contacted at TalkTalk didn't seem to be capable of understanding the problem and wouldn't escalate it. I changed my own DNS settings, but the last time I checked my (IP) neighbours were still compromised.

I'm afraid this is a misapprehension of what has taken place. The internet has not been disrupted. Rather, the settings on people's computers and routers were modified to point to malicious DNS servers.

It can over Wi-Fi on a network for which the router settings were twiddled by the malware running on a computer on the same network. Fortunately, fixing a routine is a simple matter of connecting, adjusting the DNS values, and restarting it (and setting a protective password) rather than reinstalling an operating system.

I see now. The FBI asked Paul Vixie and the Internet Systems Consortium to run replacement DNS servers starting during the raid in November 2011 (that was what Mr Vixie blogged about; his derring-do).

The FBI was able to secure permission to operate the servers (via ISC) through a judge's order, as the FBI as an agency is interacting with individuals' computers and other devices, and thus has to obtain oversight permission. It was intended as a short term move through March and then extended to July.

The precise date is known, as the FBI will ask ISC to turn off its servers at that time, which will render the machine addresses necessary to perform domain name lookups for infected machines unavailable. Some ISPs have mitigating efforts underway, but clearly hundreds of thousands of people will be effectively off the net.

Its abundantly clear that so called "viruses" and "trojans" are result of creations of "computer security industry".Silly geeks are trying to stay relevant and in demand by coming up with "malicious" apps and the "cure" for it.
If tomorrow all those "security specialists" who watch over us would disappear world will not explode in virus educed apocalypse (year 2000 hoax anyone?)
Its today form of witchery and alchemists.Suckers would be suckers and would always pay off evil spirits.

I really wish articles like this would identify which operating systems are at risk. For instance, does the DNS Changer Trojan change the operating-system settings on Linux computers? The article makes a blanket statement that would seem inaccurate for a vast number of computers.